Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
25/01/2025, 22:58 UTC
General
-
Target
2025-01-25_999b85e6c39524b7beaabe7e62f5b828_wannacry.exe
-
Size
5.0MB
-
MD5
999b85e6c39524b7beaabe7e62f5b828
-
SHA1
7f263f452d78b7bf6cdb0dba89f2fc9f723e0738
-
SHA256
707f6c5f1b711816e7fa9ab146e94cf61aac0af8c7105da60fcf06d079e8e569
-
SHA512
812459c6e035bec551c2cba6071ed365a470f419b8905a8401737128c7d2529d7e92a5195eac3cf70ef36eb640b7499189cabd751c5822f5c262416176e35562
-
SSDEEP
49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:yDqPoBhz1aRxcSUDk36SA
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3316) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-25_999b85e6c39524b7beaabe7e62f5b828_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-25_999b85e6c39524b7beaabe7e62f5b828_wannacry.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-25_999b85e6c39524b7beaabe7e62f5b828_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2025-01-25_999b85e6c39524b7beaabe7e62f5b828_wannacry.exe -m security1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228 -
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 25 Jan 2025 22:58:31 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 907bde542af9f045-LHR
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.166.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 25 Jan 2025 22:58:31 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 907bde555f7103b9-LHR
-
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.16.166.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.11.250.201:445
-
10.127.0.1:445 -
10.127.1.1:445
-
10.127.2.1:445
-
10.127.3.1:445
-
10.127.4.1:445
-
10.127.5.1:445
-
10.127.6.1:445
-
10.127.7.1:445
-
10.127.8.1:445
-
10.127.9.1:445
-
10.127.10.1:445
-
210.57.219.48:445 -
10.127.11.1:445
-
10.127.12.1:445
-
207.134.23.210:445 -
200.144.111.25:445 -
10.127.13.1:445
-
10.127.14.1:445
-
10.127.15.1:445
-
10.127.16.1:445
-
10.127.17.1:445
-
10.127.18.1:445
-
10.127.19.1:445
-
10.127.20.1:445
-
10.127.21.1:445
-
10.127.22.1:445
-
10.127.23.1:445
-
10.127.24.1:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.27.1:445
-
10.127.28.1:445
-
10.127.29.1:445
-
10.127.30.1:445
-
10.127.31.1:445
-
10.127.32.1:445
-
8.113.161.241:445
-
92.94.116.116:445 -
35.87.63.22:445
-
129.36.104.228:445
-
32.143.53.186:445
-
10.127.33.1:445
-
10.127.34.1:445
-
10.127.35.1:445
-
10.127.36.1:445
-
10.127.37.1:445
-
10.127.38.1:445
-
10.127.39.1:445
-
10.127.40.1:445
-
10.127.41.1:445
-
10.127.42.1:445
-
10.127.43.1:445
-
10.127.44.1:445
-
10.127.45.1:445
-
10.127.46.1:445
-
10.127.47.1:445
-
10.127.48.1:445
-
10.127.49.1:445
-
10.127.50.1:445
-
10.127.51.1:445
-
10.127.52.1:445
-
10.127.53.1:445
-
10.127.54.1:445
-
185.133.87.253:445 -
118.147.179.161:445 -
118.55.221.220:445 -
190.149.23.164:445 -
89.61.235.207:445 -
142.162.169.196:445
-
49.175.34.11:445
-
10.127.55.1:445
-
10.127.56.1:445
-
10.127.57.1:445
-
10.127.58.1:445
-
10.127.59.1:445
-
10.127.60.1:445
-
10.127.61.1:445
-
10.127.62.1:445
-
10.127.63.1:445
-
10.127.64.1:445
-
10.127.65.1:445
-
10.127.66.1:445
-
10.127.67.1:445
-
10.127.68.1:445
-
10.127.69.1:445
-
10.127.70.1:445
-
10.127.71.1:445
-
10.127.72.1:445
-
71.170.92.147:445
-
155.157.200.199:445
-
7.71.17.52:445
-
219.182.124.75:445 -
197.84.225.244:445 -
218.186.240.254:445 -
102.201.45.187:445 -
145.147.177.66:445 -
10.127.73.1:445
-
10.127.74.1:445
-
10.127.75.1:445
-
10.127.76.1:445
-
10.127.77.1:445
-
10.127.78.1:445
-
10.127.79.1:445
-
10.127.80.1:445
-
10.127.81.1:445
-
10.127.82.1:445
-
10.127.83.1:445
-
10.127.84.1:445
-
10.127.85.1:445
-
10.127.86.1:445
-
10.127.87.1:445
-
10.127.88.1:445
-
27.211.29.109:445
-
10.127.89.1:445
-
10.127.90.1:445
-
87.134.39.115:445
-
162.193.187.8:445
-
14.1.147.1:445 -
221.173.57.83:445
-
215.140.24.211:445
-
71.19.44.4:445
-
70.21.142.111:445
-
57.235.49.138:445 -
173.208.221.92:445
-
10.127.91.1:445
-
10.127.92.1:445
-
10.127.93.1:445
-
10.127.94.1:445
-
10.127.95.1:445
-
10.127.96.1:445
-
10.127.97.1:445
-
10.127.98.1:445
-
10.127.99.1:445
-
10.127.100.1:445
-
10.127.101.1:445
-
10.127.102.1:445
-
10.127.103.1:445
-
10.127.104.1:445
-
10.127.105.1:445
-
10.127.106.1:445
-
10.127.107.1:445
-
10.127.108.1:445
-
10.127.109.1:445
-
10.127.110.1:445
-
58.242.126.182:445
-
133.10.189.67:445
-
90.160.39.124:445 -
88.94.9.36:445 -
37.157.125.80:445 -
82.73.118.18:445
-
2.30.215.41:445 -
111.123.181.223:445
-
207.128.161.35:445
-
117.154.121.149:445
-
80.202.117.37:445
-
10.127.111.1:445
-
10.127.112.1:445
-
10.127.113.1:445
-
10.127.114.1:445
-
10.127.115.1:445
-
10.127.116.1:445
-
10.127.117.1:445
-
10.127.118.1:445
-
10.127.119.1:445
-
10.127.120.1:445
-
10.127.121.1:445
-
10.127.122.1:445
-
10.127.123.1:445
-
10.127.124.1:445
-
10.127.125.1:445
-
10.127.126.1:445
-
10.127.127.1:445
-
10.127.128.1:445
-
10.127.129.1:445
-
10.127.130.1:445
-
10.127.131.1:445
-
129.209.9.45:445
-
160.236.171.225:445 -
50.27.146.205:445
-
3.56.60.184:445
-
208.243.212.16:445
-
132.225.233.144:445
-
47.60.92.126:445
-
152.60.77.144:445
-
196.78.65.37:445 -
175.16.161.52:445
-
57.65.147.230:445
-
55.120.226.144:445
-
12.57.237.27:445
-
70.210.78.81:445
-
10.127.132.1:445
-
10.127.133.1:445
-
10.127.134.1:445
-
10.127.135.1:445
-
10.127.136.1:445
-
10.127.137.1:445
-
10.127.138.1:445
-
10.127.139.1:445
-
10.127.140.1:445
-
10.127.141.1:445
-
10.127.142.1:445
-
10.127.143.1:445
-
10.127.144.1:445
-
10.127.145.1:445
-
10.127.146.1:445
-
10.127.147.1:445
-
10.127.148.1:445
-
10.127.149.1:445
-
45.65.121.170:445 -
10.127.150.1:445
-
10.127.151.1:445
-
146.197.20.10:445
-
179.253.20.233:445
-
45.67.40.24:445
-
13.125.79.208:445
-
34.208.39.38:445
-
185.213.6.165:445
-
13.99.167.112:445
-
2.182.160.148:445 -
166.159.37.12:445
-
98.189.249.192:445
-
195.91.33.156:445 -
134.78.27.10:445
-
53.150.160.205:445
-
113.118.134.56:445
-
158.202.253.57:445
-
53.180.104.251:445
-
10.127.152.1:445
-
10.127.153.1:445
-
10.127.154.1:445
-
10.127.155.1:445
-
10.127.156.1:445
-
10.127.157.1:445
-
10.127.158.1:445
-
10.127.159.1:445
-
10.127.160.1:445
-
10.127.161.1:445
-
10.127.162.1:445
-
10.127.163.1:445
-
10.127.164.1:445
-
10.127.165.1:445
-
10.127.166.1:445
-
10.127.167.1:445
-
10.127.168.1:445
-
10.127.169.1:445
-
48.88.52.166:445
-
152.194.63.239:445
-
67.58.101.145:445
-
9.119.1.158:445
-
140.27.141.201:445
-
5.187.144.0:445 -
194.76.136.94:445
-
210.188.254.63:445
-
41.222.74.42:445 -
170.224.8.193:445
-
220.27.114.133:445
-
207.140.124.57:445
-
166.50.144.158:445
-
151.151.233.220:445
-
197.30.225.139:445 -
199.122.173.249:445
-
201.247.78.223:445 -
10.127.170.1:445
-
10.127.171.1:445
-
10.127.172.1:445
-
10.127.173.1:445
-
10.127.174.1:445
-
10.127.175.1:445
-
10.127.176.1:445
-
10.127.177.1:445
-
10.127.178.1:445
-
10.127.179.1:445
-
10.127.180.1:445
-
10.127.181.1:445
-
10.127.182.1:445
-
10.127.183.1:445
-
10.127.184.1:445
-
10.127.185.1:445
-
10.127.186.1:445
-
10.127.187.1:445
-
197.121.201.21:445 -
71.242.59.131:445
-
147.107.223.32:445
-
13.75.58.149:445 -
159.231.173.150:445
-
141.177.97.207:445
-
132.233.139.100:445
-
18.74.152.61:445
-
75.178.208.148:445
-
114.18.237.168:445
-
113.233.97.148:445
-
57.124.160.241:445
-
124.47.216.219:445
-
95.176.182.111:445 -
169.119.60.254:445
-
10.127.188.1:445
-
81.54.41.13:445
-
178.75.9.180:445 -
76.164.109.166:445
-
126.100.113.199:445
-
129.215.5.191:445
-
10.127.189.1:445
-
10.127.190.1:445
-
10.127.191.1:445
-
10.127.192.1:445
-
10.127.193.1:445
-
10.127.194.1:445
-
10.127.195.1:445
-
10.127.196.1:445
-
10.127.197.1:445
-
10.127.198.1:445
-
10.127.199.1:445
-
10.127.200.1:445
-
10.127.201.1:445
-
10.127.202.1:445
-
10.127.203.1:445
-
10.127.204.1:445
-
10.127.205.1:445
-
10.127.206.1:445
-
10.127.207.1:445
-
10.127.208.1:445
-
10.127.209.1:445
-
35.210.216.120:445 -
164.166.182.201:445
-
125.111.17.199:445
-
164.50.253.209:445
-
35.85.198.162:445
-
108.27.73.158:445
-
167.58.59.204:445 -
5.231.10.14:445
-
137.209.137.187:445
-
153.47.169.75:445
-
10.127.210.1:445
-
10.127.211.1:445
-
10.127.212.1:445
-
10.127.213.1:445
-
10.127.214.1:445
-
10.127.215.1:445
-
10.127.216.1:445
-
10.127.217.1:445
-
10.127.218.1:445
-
10.127.219.1:445
-
10.127.220.1:445
-
174.88.53.224:445
-
12.116.198.132:445
-
201.182.50.117:445
-
221.14.176.6:445
-
10.127.221.1:445
-
81.38.126.225:445
-
216.197.150.55:445
-
10.127.222.1:445
-
18.29.61.101:445
-
10.127.223.1:445
-
10.127.224.1:445
-
10.127.225.1:445
-
175.48.32.59:445
-
10.127.226.1:445
-
22.29.49.143:445
-
10.127.227.1:445
-
10.127.228.1:445
-
10.127.229.1:445
-
64.9.101.213:445
-
10.127.230.1:445
-
19.71.211.4:445
-
81.58.237.122:445
-
64.89.243.98:445
-
64.111.140.137:445
-
85.65.70.4:445 -
116.15.219.127:445
-
83.88.89.40:445 -
129.122.216.31:445 -
66.172.111.229:445
-
87.5.151.15:445
-
203.207.17.228:445
-
125.86.165.222:445
-
10.127.231.1:445
-
10.127.232.1:445
-
10.127.233.1:445
-
10.127.234.1:445
-
10.127.235.1:445
-
10.127.236.1:445
-
10.127.237.1:445
-
10.127.238.1:445
-
10.127.239.1:445
-
10.127.240.1:445
-
10.127.241.1:445
-
68.249.159.88:445
-
219.23.68.229:445
-
10.127.242.1:445
-
126.160.225.222:445
-
17.107.66.82:445
-
10.127.243.1:445
-
63.5.63.79:445
-
64.96.143.59:445
-
170.36.189.217:445
-
10.127.244.1:445
-
10.127.245.1:445
-
95.244.152.248:445
-
37.142.81.7:445
-
10.127.246.1:445
-
10.127.247.1:445
-
70.176.207.106:445
-
10.127.248.1:445
-
6.34.226.254:445
-
10.127.249.1:445
-
199.66.120.239:445
-
189.143.7.126:445 -
29.201.109.53:445
-
177.245.252.224:445
-
93.131.207.92:445
-
157.61.32.0:445
-
16.142.21.224:445
-
136.65.14.28:445
-
192.155.105.242:445
-
159.102.26.105:445
-
159.57.168.239:445
-
49.231.72.30:445 -
80.127.43.58:445
-
28.165.122.42:445
-
10.127.250.1:445
-
10.127.251.1:445
-
10.127.252.1:445
-
10.127.253.1:445
-
10.127.254.1:445
-
10.127.255.1:445
-
10.127.0.2:445
-
10.127.1.2:445
-
10.127.2.2:445
-
10.127.3.2:445
-
10.127.4.2:445
-
10.127.5.2:445
-
101.222.193.246:445 -
10.127.6.2:445
-
170.210.106.182:445 -
10.127.7.2:445
-
193.108.25.164:445 -
10.127.8.2:445
-
15.158.239.92:445
-
112.206.77.147:445 -
14.136.201.236:445
-
10.127.9.2:445
-
177.37.31.123:445
-
10.127.10.2:445
-
62.41.15.146:445
-
142.89.179.253:445
-
10.127.11.2:445
-
181.197.97.243:445 -
194.25.203.41:445
-
74.99.235.173:445
-
61.114.23.126:445
-
59.152.201.19:445
-
79.85.69.179:445
-
82.72.129.19:445
-
31.111.236.121:445
-
58.7.218.66:445
-
64.112.0.53:445
-
209.86.145.208:445
-
48.128.201.216:445
-
115.52.2.86:445
-
53.136.74.116:445
-
187.72.182.54:445
-
163.215.45.169:445
-
165.183.154.67:445 -
10.127.12.2:445
-
10.127.13.2:445
-
10.127.14.2:445
-
10.127.15.2:445
-
10.127.16.2:445
-
10.127.17.2:445
-
10.127.18.2:445
-
10.127.19.2:445
-
10.127.20.2:445
-
10.127.21.2:445
-
10.127.22.2:445
-
10.127.23.2:445
-
188.224.180.161:445
-
10.127.24.2:445
-
63.156.160.51:445
-
10.127.25.2:445
-
121.235.48.68:445
-
10.127.26.2:445
-
10.127.27.2:445
-
149.58.203.70:445
-
10.127.28.2:445
-
5.196.246.44:445
-
10.127.29.2:445
-
176.139.147.241:445
-
10.127.30.2:445
-
195.84.18.138:445 -
175.95.233.167:445
-
10.127.31.2:445
-
158.24.11.31:445
-
103.202.236.107:445
-
10.127.32.2:445
-
58.221.70.121:445
-
190.44.200.183:445
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.166.228104.16.167.228
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD54494256f186e5f30737e2d93f9e15f65
SHA1a58c00600d586f4f4753acec51499a4fccc04d1f
SHA2561e9bc7de8e823eba8c1898a266545d353e6d4f44ef93c206a8736afc0456207a
SHA5120af2ca2e362968a156bd88786c6fb4405e11d783af02a14325c64c08ac5b9176d6bbb2d700a556335891eac963ae8e0a3304df8b2993e86d0b4af6e27dcc6f25